Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the unexpanded $VAR references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. This vulnerability is fixed in 1.5.128.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-09 | 2 | Disclosure2 |
| 2026-04-10 | 1 | Disclosure1 |
CVE-2026-40153 Environment Variable Injection in PraisonAIAgents Prior to Version 1.5.128 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40153
Post summary
The entry announces CVE-2026-40153 as an environment variable injection vulnerability affecting PraisonAIAgents versions earlier than 1.5.128.
🚨*CVE* CVE-2026-40153 PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument a… https://www.cve.org/CVERecord?id=CVE-2026-40153 ----- Traducción: CVE-2026-40153 Pra… http://infoflow.cloud`
Post summary
The post references CVE-2026-40153 with a technical detail about improper variable expansion in execute_command, but provides no PoC, exploit, patch, or active exploitation evidence.
CVE-2026-40153 PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument a… https://www.cve.org/CVERecord?id=CVE-2026-40153
Post summary
The text provides a brief technical detail of CVE‑2026‑40153, noting insecure environment variable expansion in a command‑execution function before version 1.5.128, but does not mention PoC, exploit code, active exploitation, or patches.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | praison | praisonaiagents | - | - | - |